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Listing of the Claims: 

1 . (currently amended) A computer-readable medium having 
computer-executable instructions, comprising: 

performing ordinary error checking until a system crash of a particular type 

occurs; and 

after the system crash, power on self tests, and initiation of booting to an 
operating system, executing instructions and automatically performing enhanced 
error checking including checking for memory corruption , the enhanced error 
checking performed depending on the particular type of system crash and operating 
to assist in locating instructions or software components that caused the system 
crash. 

2. (original) The computer-readable medium of claim 1 , further 
comprising: 

upon the system crash, storing a stop code that identifies the particular type 
of system crash; and 

after the power on self test and the initiation of booting to an operating 
system, retrieving the stop code and determining the enhanced error checking to 
perform based on the stop code. 
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3. (currently amended) The computer-readable medium of claim 1 , 
wherein the enhanced error checking is performed prior to a user d i ag n os e s 
diagnosis related to the system crash. 

4. (currently amended) The computer-readable medium of claim 1 , 
wherein the enhanced error checking is performed without a user diagnoses 
diagnosis related to the system crash. 

5 . (currently amended) The computer-readable medium of claim 1 , 
wherein the enhanced error checking further comprises checking resource-related 
operations. 

6. (original) The computer-readable medium of claim 5, wherein the 
resource-related operations comprise allocating and freeing memory. 

7. (currently amended) The computer-readable medium of claim 6, 
wherein checking the resource-related operations further comprises tracking each 
allocation and freeing of memory performed by at least one process. 

8. (currently amended) The computer-readable medium of claim 5, 
wherein the resource-related operations are performed by drivers that execute in 
kernel mode. 
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9. (currently amended) The computer-readable medium of G lai m - 5 
claim 1 . wherein the resource-related operations further comprise allocating and 
freeing page table entries. 

10. (canceled). 

1 1 . (currently amended)The computer-readable medium of c l a i m 10 claim 
1, wherein the memory corruption occurs in memory reserved for kernel processes. 

12. (original) The computer-readable medium of claim 1 1, wherein the 
memory corruption occurs by a kernel process writing to a block of memory after the 
kernel process has freed the block of memory. 

1 3. (original) The computer-readable medium of claim 1 1 p further 
comprising loading a driver verifier to monitor actions of one or more of the kernel 
processes. 

14. (currently amended) The computer-readable medium of claim 13, 
wherein the driver verifier provides a memory block to the one or more kernel 
processes, and wherein the memory block is marked to remain in memory. 
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1 5. (currently amended) The computer-readable medium of claim 14, 
wherein the memory block is aligned with the end of a page of memory having a 
following page, and wherein the following page is marked as inaccessible, such that 
an access to the following page results in an access violation. 

16. (currently amended) A computer-readable medium having 
computer-executable instructions, comprising: 

storing information associated with the system crash of a particular type, the 
information including a stop code that identifies the particular type of system crash; 

reading the stop code from the information ^wherein reading the stop code 
occurs after an pperatinq system begins executing : and 

automatically initiating a diagnostic procedure associated with the stop code* 
the diagnostic procedure designed to identify an instruction or software component 
that caused the system crash by collecting data tailored to identifying errors of the 
particular type that caused the system crash. 

17. (canceled). 

1 8. The computer-readable medium of claim 17 claim 16. further 
comprising changing the stop code before initiating the diagnostic procedure to 
select the diagnostic procedure. 
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19. (canceled). 

20. (new) A computer-readable medium having computer- 
executable instructions, comprising: 

performing ordinary error checking until a system crash of a particular type 
occurs; and 

after the system crash, power on self tests, and initiation of booting to an 
operating system, executing instructions and automatically performing enhanced 
error checking, the enhanced error checking performed depending on the particular 
type of system crash and operating to assist in locating instructions or software 
components that caused the system crash, and wherein the enhanced error 
checking comprises checking resource-related operations including allocating and 
freeing memory. 

21. (new) The computer-readable medium of claim 20, wherein checking 
the resource-related operations comprises tracking each allocation and freeing of 
memory performed by at least one process. 

22. (new) A computer-readable medium having computer- 
executable instructions, comprising: 

performing ordinary error checking until a system crash of a particular type 
occurs; and 
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after the system crash, power on self tests, and initiation of booting to an 
operating system, executing instructions and automatically performing enhanced 
error checking, the enhanced error checking performed depending oh the particular 
type of system crash and operating to assist in locating instructions or software 
components that caused the system crash, wherein the enhanced error checking 
comprises checking resource-related operations, and wherein the resource-related 
operations are performed by drivers that execute in kernel mode. 

23. (new) A computer-readable medium having computer- 

executable instructions, comprising: 

performing ordinary error checking until a system crash of a particular type 
occurs; and 

after the system crash, power on self tests, and initiation of booting to an 
operating system, executing instructions and automatically performing enhanced 
error checking, the enhanced error checking performed depending on the particular 
type of system crash and operating to assist in locating instructions or software 
components that caused the system crash, wherein the enhanced error checking 
comprises checking resource-related operations including allocating and freeing 
page table entries. 
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